PLEASE NOTE: I HAVE PERMANENTLY MOVED MY BLOG TO http://www.rationalsurvivability.com/blog

October 16, 2007

Just as I finished up a couple of posts decrying the investments being made in lumping device after device on DMZ boundaries for the sake of telling party guests that one subscribes to the security equivalent of the "Jam of the Month Club," (AKA Defense-In-Depth) I found a fantastic post on the CERIAS blog where Prof. Eugene Spafford wrote a fantastic piece titled "Solving Some of the Wrong Problems."

In the last two posts (here and here,) I used the example of the typical DMZ and it's deployment as a giant network colander which, despite costing hundreds of thousands of dollars, doesn't generally deliver us from the attacks it's supposedly designed to defend against -- or at least those that really matter.

This is mostly because these "solutions" treat the symptoms and not the problem but we cling to the technology artifacts because it's the easier road to hoe.

I've spent a lot of time over the last few months suggesting that people ought to think differently about who, what, why and how they are focusing their efforts. This has come about due to some enlightenment I received as part of exercising my noodle using my blog. I'm hooked and convinced it's time to make a difference, not a buck.

Yes, you. You who have chided me privately and publicly for my recent proselytizing that our efforts are focused on solving the wrong sets of problems. The same you who continues to claw disparately at your sacred firewalls whilst we have many of the tools to solve a majority of the problems we face, and choose to do otherwise. This isn't an "I told you so." It's a "You should pay attention to someone who is wiser than you and I."

Feel free to tell me I'm full of crap (and dismiss my ramblings as just that,) but I don't think that many can claim to have earned the right to suggest that Spaf has it wrong dismiss Spaf's thoughts offhandedly given his time served and expertise in matters of information assurance, survivability and security:

As I write this, I’m sitting in a review of some university research
in cybersecurity. I’m hearing about some wonderful work (and no, I’m
not going to identify it further). I also recently received a
solicitation for an upcoming workshop to develop “game changing” cyber
security research ideas. What strikes me about these efforts —
representative of efforts by hundreds of people over decades, and the
expenditure of perhaps hundreds of millions of dollars — is that the
vast majority of these efforts have been applied to problems we already
know how to solve.

We know how to prevent many of our security problems — least
privilege, separation of privilege, minimization, type-safe languages,
and the like. We have over 40 years of experience and research about
good practice in building trustworthy software, but we aren’t using
much of it.

Instead of building trustworthy systems (note — I’m not referring to
making existing systems trustworthy, which I don’t think can succeed)
we are spending our effort on intrusion detection to discover when our
systems have been compromised.

We spend huge amounts on detecting botnets and worms, and deploying
firewalls to stop them, rather than constructing network-based systems
with architectures that don’t support such malware.

Instead of switching to languages with intrinsic features that
promote safe programming and execution, we spend our efforts on tools
to look for buffer overflows and type mismatches in existing code, and
merrily continue to produce more questionable quality software.

And we develop almost mindless loyalty to artifacts (operating
systems, browsers, languages, tools) without really understanding where
they are best used — and not used. Then we pound on our selections as
the “one, true solution” and justify them based on cost or training or
“open vs. closed” arguments that really don’t speak to fitness for
purpose. As a result, we develop fragile monocultures that have a
particular set of vulnerabilities, and then we need to spend a huge
amount to protect them. If you are thinking about how to secure Linux
or Windows or Apache or C++ (et al), then you aren’t thinking in terms
of fundamental solutions.

Please read his entire post. It's wonderful. Dr. Spafford, I apologize for re-posting so much of what you wrote, but it's so fantastically spot-on that I couldn't help myself.

Timing is everything.

/Hoff

{Ed: I changed the sentence regarding Spaf above after considering Wismer's comments below. I didn't mean to insinuate that one should preclude challenging Spaf's assertions, but rather that given his experience, one might choose to listen to him over me any day -- and I'd agree! Also, I will get out my Annie Oakley decoder ring and address that Cohen challenge he brought up after at least 2-3 hours of sleep... ;) }

October 02, 2007

Dude, maybe if we put bras on our heads and chant incoherently we can connect directly to the Internet...

Somebody just pushed my grumpy button! I'm all about making friends and influencing people, but the following article titled "You Wouldn't Actually Turn Off Your Firewall, Would You?" is simply a steaming heap of unqualified sensationalism, plain and simple.

It doesn't really deserve my attention but the FUD it attempts to promulgate is nothing short of Guinness material and I'm wound up because my second Jiu Jitsu class of the week isn't until tomorrow night and I've got a hankering for an arm-bar.

Larry Seltzer from eWeek decided to pen an opinion piece which attempts for no good reason to collapse two of my favorite topics into a single discussion: de-perimeterization (don't moan!) and virtualization.

What one really has to do directly with the other within the context of this discussion, I don't rightly understand, but it makes for good drama I suppose.

Larry starts off with a question we answered in this very blog (here, here, here and here) weeks ago:

Opinion: I'm unclear on what deperimeterization means. But if it means putting
company systems directly on the Internet then it's a big mistake.

OK, that's a sort of a strange way to state an opinion and hinge an article, Larry. Why don't you go to the source provided by those who coined the term, here. Once you're done there, you can read the various clarifications and debates above.

But before we start, allow me to just point out that almost every single remote salesperson who has a laptop that sits in a Starbucks or stays in a hotel is often connected "...directly on the Internet." Oh, but wait, they're sitting behind some sort of NAT gateway broadband-connected super firewall, ya? Certainly the defenses at Joe's Java shack must be as stringent as a corporate firewall, right? <snore>

So you've been thinking about this for weeks and don't mention if
you've spoken to anyone from the Jericho Forum (it's quite obvious you haven't read their 10 commandments) or anyone mentioned in the article
save for a couple of analysts who decided to use a buzzword to get some
press? Slow newsday, huh?

At least the goal of deperimeterization is to enhance security.
That I can respect. The abstract point seems to be to identify the
resources worth protecting and to protect them. "Resources" is defined
very, very broadly.

The overreacting approach to this goal is to say
that the network firewall doesn't fit into it. Why not just put systems
on the Internet directly and protect the resources on them that are
worthy of protection with appropriate measures?

Certainly the network firewall fits into it. Stateful inspection firewalls are, for the most part today, nothing more than sieves that filter out the big chunks. They serve that purpose very nicely. They allow port 80 and port 443 traffic through unimpeded. Sweet. That's value.

Even the inventors of stateful inspection will tell you so (enter one Shlomo Kramer and Nir Zuk.) Most "firewalls" (in the purest definition) don't do much more than stateful ACL's do today and are supplemented with IDS's, IPS's, Web Application Firewalls, Proxies, URL Filters, Anti-Virus, Anti-Spam, Anti-Malware and DDoS controls for that very reason.

Yup, the firewall is just swell, Larry. Sigh.

I hope I'm not misreading the approach, but that's what I got out of
our news article: "BP has taken some 18,000 of its 85,000 laptops off
its LAN and allowed them to connect directly to the Internet,
[Forrester Research analysts Robert Whiteley and Natalie Lambert]
said." This is incredible, if true.

Not for nothing, but rather than depend on a "couple of analysts," did you think to contact someone from BP and ask them what they meant instead of speculating and deriding the effort before you condemned it? Obviously not:

What does it mean? Perhaps it just means that they can connect
to the VPN through a regular ISP connection? That wouldn't be news. On
the other hand, what else can it mean? Whitely and Lambert seem to view
deperimeterization as a means to improve performance and lower cost. If
you need to protect the data on a notebook computer they say you should
do it with encryption and "data access controls." This is the
philosophy in the 2001 article in which the term was coined.

Honestly, who in Sam's Hill cares what "Whitely and Lambert" seem to view deperimeterization as? They didn't coin the term, they butchered its true intent and you still don't apparently know how to answer your own question.

Further, you also reference a conceptual document floated back in 2001 ignoring the author's caution that "The actual concept behind the entire paper never really flew, but you may find that too thought provoking." Onward.

But of course you can't just put a system on Comcast and have it
access corporate resources. VPNs aren't just about security, they
connect a remote client into the corporate network. So unless everyone
in the corporation has subnet mask of 0.0.0.0 there needs to be some
network management going on.

Firstly, nobody said that network management should be avoided, where the heck did you get that!?

Secondly, if you don't have firewalls in the way, sure you can -- but that would be cheating the point of the debate. So we won't go there. Yet. OK, I lied, here we go.

Thirdly, if you look at what you will get with, say, Vista and Longhorn, that's exactly what you'll be able to do. You can simply connect to the Internet and using encryption and mutual authentication, gain access to internal corporate resources without the need for a VPN client at all. If you need a practical example, you can read about it here, where I saw it with my own eyes.

Maybe...but we're just dreamers. I dare say, Larry, that Bill Cheswick has forgotten more about security than you and I know. It's obvious you've not read much about information assurance or information survivability but are instead content to myopically center on what "is" rather than that which "should be."

Not everyone has this cavalier attitude towards deperimeterization. This article from the British Computer Society
seems a lot more conservative in approach. It refers to protecting
resources "as if [they were] directly exposed to the Internet." It
speaks of using "network segmentation, strict access controls, secure
protocols and systems, authentication and encryption at multiple
levels."

Cavalier!? What's so cavalier about suggesting that systems ought to be stand-alone defensible in a hostile environment as much as they are behind one of those big, bad $50,000 firewalls!? I bet you money I can put a hardened host on the Internet today without a network firewall in front of it and it will be just as resistant to attack.

But here's the rub, nobody said that to get from point A to point B one would not pragmatically apply host-based hardening and layered security such as (wait for it) a host-based firewall or HIPS? Gasp!

What's the difference between filtering TCP handshakes or blocking based on the 4/5 tupule at a network level versus doing it at the host when you're only interested in scaling to performance and commensurately secured levels of a single host? Except for tens of thousands of dollars. How about Nada? (That's Spanish for "Damn this discussion is boring...")

And whilst my point above is in response to your assertions regarding "clients," the same can be said for "servers." If I use encryption and mutual authentication, short of DoS/DDoS, what's the difference?

That sounds like a shift in emphasis, moving resources more
towards internal protection, but not ditching the perimeter. I might
have some gripes with this—it sounds like the Full Employment Act for
Security Consultants, for example—but it sounds plausible as a useful
strategy.

I can't see how you'd possibly have anything bad to say about this approach especially when you consider that the folks that make up the Jericho Forum are CISO's of major corporations, not scrappy consultants looking for freelance pen-testing.

When considering the protection of specific resources, Whitely and
Lambert go beyond encryption and data access controls. They talk
extensively about "virtualization" as a security mechanism. But their
use of the term virtualization sounds like they're really just talking
about terminal access. Clearly they're just abusing a hot buzzword.
It's true that virtualization can be involved in such setups, but it's
hardly necessary for it and arguably adds little value. I wrote a book
on Windows Terminal Server back in 2000 and dumb Windows clients with
no local state were perfectly possible back then.

So take a crappy point and dip it in chocolate, eh? Now you're again tainting the vision of de-perimeterization and convoluting it with the continued ramblings of a "couple of analysts." Nice.

Whitely and Lambert also talk in this context about how updating in
a virtualized environment can be done "natively" and is therefore
better. But they must really mean "locally," and this too adds no
value, since a non-virtualized Terminal Server has the same advantage.

What is the security value in this? I'm not completely clear
on it, since you're only really protecting the terminal, which is a
low-cost item. The user still has a profile with settings and data. You
could use virtual machines to prevent the user from making permanent
changes to their profile, but Windows provides for mandatory (static,
unchangeable) profiles already, and has for ages. Someone explain the
value of this to me, because I don't get it.

Well, that makes two of us..

And besides, what's it got to do with deperimeterization? The
answer is that it's a smokescreen to cover the fact that there are no
real answers for protecting corporate resources on a client system
exposed directly to the Internet.

Well, I'm glad we cleared that up. Absolutely nothing. As to the smokescreen comment, see above. I triple-dog-dare you. My Linux workstation and Mac are sitting on "the Internet" right now. Since I've accomplished the impossible, perhaps I can bend light for you next?

The reasonable approach is to treat local and perimeter security as
a "belt and suspenders" sort of thing, not a zero sum game. Those who
tell you that perimeter protections are a failure because there have
been breaches are probably just trying to sell you protection at some
other layer.

...or they are pointing out to you that you're treating the symptom and not the problem. Again, the Jericho Forum is made up of CISO's of major multinational corporations, not VP's of Marketing from security vendors or analyst firms looking to manufacture soundbites.

Now I have to set a reminder for myself in Outlook for about
two years from now to write a column on the emerging trend towards
"reperimeterization."

Actually, Larry, set that appointment back a couple of months...it's already been said. De-perimeterization has been called many things already, such as re-perimeterization or radical externalization.

I don't really give much merit to what you choose to call it, but I call it a good idea that should be discussed further and driven forward in consensus such that it can be used as leverage against the software and OS vendors to design and build more secure systems that don't rely on band-aids.

September 26, 2007

Well, a humble, well-spoken and intelligent monster who -- like me -- isn't afraid to admit that sometimes it's better to let go than grip the bat too tight. That doesn't happen often, but when it does, it's a wonderful thing.

I reckon that despite having opinions, perhaps sometimes it's better to listen with two holes and talk with one, shrugging off the almost autonomic hardline knee-jerks of defensiveness that come from having to spend years of single minded dedication to cramming good ideas down people's throats.

It appears Amrit's been speaking to my wife, or at least they read the same books.

So it is with the utmost humility that I take full credit for nudging along Amrit's renaissance and spiritual awakening as evidenced in this, his opus magnum of personal growth titled "Embracing Humility - Enlightened Information Security" wherein a dramatic battle of the Ego and Id is played out in daring fashion before the world:

Too often in IT ego drives one to be rigid and stubborn. This results
in a myopic and distorted perspective of technology that can limit ones
ability to gain an enlightened view of dynamic and highly volatile
environments. This defect is especially true of information security
professionals that tend towards ego driven dispositions that create
obstacles to agility. Agility is one of the key foundational tenets to
achieving an enlightened perspective on information security; humility
enables one to become agile. Humility, which is far different from
humiliation, is the wisdom to realize one’s own ignorance,
insignificance, and limitations of intellect, without which one cannot
see the truth.

19th century philosopher Herbert Spencer captured this sentiment in
an oft-cited quote “There is a principle which is a bar against all
information, which is proof against all arguments and which cannot fail
to keep a man in everlasting ignorance - that principle is contempt
prior to investigation.”

The security blogging community is one manifestation of the
information security profession, based upon which one could argue that
security professionals lack humility and generally propose contempt for
an idea prior to investigation. I will relate my own experience to
highlight this concept.

Humility and the Jericho Forum
I was one of the traditionalists that was vehemently opposed to the
ideas, at least my understanding of the ideas, put forth by the Jericho
forum. In essence all I heard was “de-perimeterization”, “Firewalls are
dead and you do not need them”, and “Perfect security is achieved
through the end-point” – I lacked the humility required to properly
investigate their position and debated against their ideas blinded by
ego and contempt. Reviewing the recent spate of blog postings related
to the Jericho forum I take solace in knowing that I was not alone in
my lack of humility. The reality is that there is a tremendous amount
of wisdom in realizing that the traditional methods of network security
need to be adjusted to account for a growing mobile workforce, coupled
with a dramatic increase in contractors, service providers and non pay
rolled actors, all of which demand access to organizational assets, be
it individuals, information or infrastructure. In the case of the
Jericho forum’s ideas I lacked humility and it limited my ability to
truly understand their position, which limits my ability to broaden my
perspective’s on information security.

Good stuff.

It takes a lot of chutzpah to privately consider changing one's stance on matters; letting go of preconceived notions and embracing a sense of openness and innovation. It's quite another thing to do it publicly. I think that's very cool. It's always been a refreshing study in personal growth when I've done it.

I know it's still very hard for me to do in certain areas, but my kids -- especially my 3 year old -- remind me everyday just how fun it can be to be wrong and right within minutes of one another without any sense of shame.

I'm absolutely thrilled if any of my posts on Jericho and the ensuing debate has made Amrit or anyone else consider for a moment that perhaps there are other alternatives worth exploring in the way in which we think, act and take responsibility for what we do in our line of work.

I could stop blogging right now and...

Yeah, right. Stiennon, batter up!

/Hoff

(P.S. Just to be clear, I said "batter" not "butter"...I'm not that open minded...)

September 21, 2007

Just to be clear, I don't set out to "win" everything I post about. It may come off that way, but I write from a stream of consciousness; my blog is usually my own little jot pad for working through thought patterns that could often times could use a little pinging from others on the subject.

My blog has seen the evolution of some of my thinking; it's produced profound realizations and even reversals in my own opinions and thoughts. I think that's cool.

In the case of the last series of posts which started here regarding the Jericho Forum, however, I wanted to start a dialog. I knew it was going to be a slog, because people always get riled up on the subject of the Jericho Forum's vision.

I wanted to take this contentious subject and drag it into the light some more, especially here in the U.S. where the concepts are met with a litany of protest -- usually due not to the content, but rather the context around which they are framed and by whom.

At any rate, I banged out my posts over the last couple of days and regardless of the fact that almost nobody can see the forest for the trees, here's what we ended up with; I'd suggest reading the last two as the others are rather like a blog version of demolition derby that don't actually rationalize much on the subject at all:

...and only because I love, I'm going to highlight the last line of what otherwise would be a very interesting exploration of LV's Jericho ponderings:

So what we have so far is very heart-warming, feel-good idealistic
goals for a global infrastructure (extrastructure?) utilizing perfect
or near perfect protocols and devices that can withstand anything.
Sorry, but what the fuck...?

Wow. I have no response to that. On second thought, I do, but I'm not sure I can say it again without screaming. See here for a clue.

September 19, 2007

The Mogull decides that rather than contribute meaningful dialog to discuss the meat of the topic at hand, he would rather contribute to the FUD regarding the messaging of the Jericho Forum that I was actually trying to wade through.

...and he tried to be funny. Sober. Painful combination.

In a deliciously ironic underscore to his BlogSlog, Rich caps off his post with a brilliant gem of obviousness of his own whilst chiding everyone else to politely "stay on message" even when he leaves the reservation himself:

"I formally
submit “buy secure stuff” as a really good one to keep us busy for a
while."

So if we hit the rewind button for a second, let's revisit Captain Stupendous' illuminating commentary. Yessir. Captain Stupendous it is, Rich, since the franchise on Captain Obvious is plainly over-subscribed.I spent my time in my last post suggesting that the Jericho Forum's message is NOT that one should toss away their firewall. I spent my time suggesting that rather reacting to the oft-quoted and emotionally flammable marketing and messaging, folks should actually read their 10 Commandments as a framework.

I wish Rich would have read them because his post indicates to me that the sensational hyperbole he despises so much is hypocritically emanating from his own VoxHole. <sigh>

Here's a very high-level generalization that I made which was to take the focus off of "throwing away your firewall":

Your perimeter *is* full of holes so what we need to do is fix the problems, not the symptoms. That is the message.

And Senor Stupendous suggested:

Of course the perimeter is full of holes; I haven’t met a security
professional who thinks otherwise. Of course our software generally
sucks and we need secure platforms and protocols. But come on guys,
making up new terms and freaking out over firewalls isn’t doing you any
good. Anyone still think the network boundary is all you need? What? No
hands? Just the “special” kid in back? Okay, good, we can move on now.

You're missing the point -- both theirs and mine. I was restating the argument as a setup to the retort. But who can resist teasing the mentally challenged for a quick guffaw, eh, Short Bus?

Here is the actual meat of the Jericho Commandments. I'm thrilled that Rich has this all handled and doesn't need any guidance. However, given how I just spent my last two days, I know that these issues are not only relevant, but require an investment of time, energy, and strategic planning to make actionable and remind folks that they need to think as well as do.

I defy you to show me where this says "throw away your firewalls."

Repeat after me: THIS IS A FRAMEWORK and provides guidance and a rational, strategic approach to Enterprise Architecture and how security should be baked in. Please read this without the FUDtastic taint:

Rich sums up his opus with this piece of reasonable wisdom, which I wholeheartedly agree with:

You have some big companies on board and could use some serious
pressure to kick those market forces into gear.

...and to warm the cockles of your heart, I submit they do and they are. Spend a little time with Dr. John Meakin, Andrew Yeomans, Stephen Bonner, Nick Bleech, etc. and stop being so bloody American ;) These guys practice what they preach and as I found out, have been for some time.

They've refined the messaging some time ago. Unload the baggage and give it a chance.

Look at the real message above and then see how your security program measures up against these topics and how your portfolio and roadmap provides for these capabilities.

September 17, 2007

Back in 2006, after numerous frustrating discussions dating back almost three years without a convincing conclusion, I was quoted in an SC Magazine article titled "World Without Frontiers" which debated quite harshly the Jericho Forum's evangelism of a security mindset and architecture dubbed as "de-perimeterization."

Here's part of what I said:

Some people dismiss Jericho as trying to re-invent the wheel. "While
the group does an admirable job raising awareness, there is nothing
particularly new either in what it suggests or even how it suggests we
get there," says Chris Hoff, chief security strategist at Crossbeam
Systems.

"There is a need for some additional technology and
process re-tooling, some of which is here already – in fact, we now
have an incredibly robust palette of resources to use. But why do we
need such a long word for something we already know? You can dress
something up as pretty as you like, but in my world that's not called
'deperimeterisation', it's called a common sense application of
rational risk management aligned to the needs of the business."

Hoff
insists the Forum's vision is outmoded. "Its definition speaks to what
amounts to a very technically focused set of IT security practices,
rather than data survivability. What we should come to terms with is
that confidentiality, integrity and availability will be compromised.
It's not a case of if, it's a case of when.

The focus should
be less on IT security and more on information survivability; a
pervasive enterprise-wide risk management strategy and not a
narrowly-focused excuse for more complex end-point products," he says.

But is Jericho just offering insight into the obvious? "Of course,"
says Hoff. "Its suggestion that "deperimeterisation" is somehow a new
answer to a set of really diverse, complex and long-standing IT
security issues... simply ignores the present and blames the past," he
says.

"We don't need to radically deconstruct the solutions
universe to arrive at a more secure future. We just need to learn how
to appropriately measure risk and quantify how and why we deploy
technology to manage it. I admire Jericho's effort, and identify with
the need. But the problem needs to be solved, not renamed."

I have stated previously that this was an unfortunate reaction to the marketing of the message and not the message itself, and I've come to understand what the Jericho Forum's mission and its messaging actually represents. It's a shame that it took me that long and that others continue to miss the point.

Today Mike Rothman commented about NetworkWorld's coverage of the latest Jericho Forum in New York last week. The byline of the article suggested that "U.S. network execs clinging to firewalls" and it seems we're right back on the Hamster Wheel of Pain, perpetuating a cruel myth.

After all this time, it appears that the Jericho Forum is apparently still suffering from a failure to communicate -- there exists a language gap -- probably due to that allergic issue we had once to an English King and his wacky ideas relating to the governance of our "little island." Shame, that.

This is one problem that this transplanted Kiwi-American (same Queen after-all) is motivated to fix.

Unfortunately, the Jericho Forum's message has become polluted and marginalized thanks to a perpetuated imprecise suggestion that the Forum recommends that folks simply turn off their firewalls and IPS's and plug their systems directly into the Internet, as-is.

That's simply not the case, and in fact the Forum has recognized some of this messaging mess, and both softened and clarified the definition by way of the issuance of their "10 Commandments."

You can call it what you like: de-perimeterization, re-perimeterization or radical externalization, but here's what the Jericho Forum actually advocates, which you can read about here:

De-perimeterization explained
The huge explosion in business use of the Web protocols means that:

today the traditional "firewalled" approach to securing a network boundary is at best flawed, and at worst ineffective. Examples include:

business demands that tunnel through perimeters or bypass them altogether

IT products that cross the boundary, encapsulating their protocols within Web protocols

security exploits that use e-mail and Web to get through the perimeter.

to respond to future business needs, the break-down of the traditional
distinctions between “your” network and “ours” is inevitable

increasingly, information will flow between business organizations over
shared and third-party networks, so that ultimately the only reliable
security strategy is to protect the information itself, rather than the
network and the rest of the IT infrastructure

This
trend is what we call “de-perimeterization”. It has been developing for
several years now. We believe it must be central to all IT security
strategies today.

The de-perimeterization solutionWhile
traditional security solutions like network boundary technology will
continue to have their roles, we must respond to their limitations. In
a fully de-perimeterized network, every component will be independently
secure, requiring systems and data protection on multiple levels, using
a mixture of

encryption

inherently-secure computer protocols

inherently-secure computer systems

data-level authentication

The design principles that guide the development of such technology solutions are what we call our “Commandments”, which capture the essential requirements for IT security in a de-perimeterized world.

Take a host with a secured OS, connect it into any network using whatever means you find appropriate,
without regard for having to think about whether you're on the "inside"
or "outside." Communicate securely, access and exchange data in
policy-defined "zones of trust" using open, secure, authenticated and
encrypted protocols.

Did you know that one of the largest eCommerce sites on the planet doesn't even bother with firewalls in front of its webservers!? Why? Because with 10+ Gb/s of incoming HTTP and HTTP/S connections using port 80 and 443 specifically, what would a firewall add that a set of ACLs that only allows port 80/443 through to the webservers cannot?

Nothing. Could a WAF add value? Perhaps. But until then, this is a clear example of a U.S. company that gets the utility of not adding security in terms of a firewall just because that's the way it's always been done.

From the NetworkWorld article, this is a clear example of the following:

The forum’s view of firewalls is that they no longer meet the needs of businesses that increasingly need to let in traffic
to do business. Its deperimeterization thrust calls for using secure applications and firewall protections closer to user devices and servers.

It's not about tossing away prior investment or abandoning one's core beliefs, it's about about being honest as to the status of information security/protection/assurance, and adapting appropriately.

Your perimeter *is* full of holes so what we need to do is fix the problems, not the symptoms.That is the message.

So consider me the self-appointed U.S. Ambassador to our friends across the pond. The Jericho Forum's message is worth considering and deserves your attention.